coollabsio coolify up to 4.0.0-beta.360 Server Configuration authorization

Summaryinfo

A vulnerability classified as very critical was found in coollabsio coolify up to 4.0.0-beta.360. Affected is an unknown function of the component Server Configuration Handler. Executing a manipulation can lead to authorization. The identification of this vulnerability is CVE-2025-22609. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in coollabsio coolify up to 4.0.0-beta.360 and classified as very critical. This vulnerability affects an unknown function of the component Server Configuration Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.

The advisory is available at github.com. This vulnerability was named CVE-2025-22609 since 01/07/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/19/2025).

Upgrading to version 4.0.0-beta.361 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• coollabsio

Name

• coolify

Version

• 4.0.0-beta.360

Website

• Product: https://github.com/coollabsio/coolify/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion